|
Getting your Trinity Audio player ready...
|
Hackers have exploited a critical vulnerability in Cisco Catalyst SD-WAN systems to gain privileged access and deploy a custom malware framework designed to maintain access to affected network controllers and collect sensitive encryption key material.
The vulnerability, tracked as CVE-2026-20127, carries the maximum CVSS severity score of 10.0. Cisco patched the flaw in February 2026, but security researchers have now detailed historical attacks in which threat actors used the vulnerability to compromise Cisco SD-WAN control components and install a malware framework called KeyDrift.
The discovery is particularly serious for organisations that use SD-WAN to connect branch offices, data centres and other critical locations because the compromised systems sit at the centre of network management and control.
Cisco Talos, which investigated the activity, identified the threat cluster as UAT-11473. The group targeted organisations operating in strategically important sectors, including space and satellite services, defence and aerospace technology, and policy research.
Talos said the attackers used the authentication bypass in CVE-2026-20127 to obtain unauthorised access to Cisco Catalyst SD-WAN Controller instances. The affected product family includes the Controller, formerly known as vSmart, Manager, formerly vManage, and Validator, formerly vBond.
The significance of the flaw lies in what an attacker can do after gaining access.
CVE-2026-20127 allows a remote, unauthenticated attacker to bypass the peering authentication mechanism and obtain high-level privileges. From there, an attacker can manipulate aspects of the SD-WAN environment and establish access that can be used for further intrusion.
That makes the vulnerability considerably more dangerous than a flaw limited to a single application or endpoint.
An SD-WAN controller helps determine how traffic moves between connected locations. Compromise at that level can therefore give an attacker visibility into network operations and create opportunities to interfere with communications or move deeper into an organisation’s infrastructure.
KeyDrift appears to have been developed specifically to take advantage of that position.
According to Talos, the malware is not a conventional standalone program that an employee downloads or executes. Instead, it is a custom framework designed to operate within Cisco SD-WAN control-plane processes.
Its components allow attackers to maintain persistent access, execute commands, communicate with compromised systems and collect sensitive cryptographic information.
One of the most concerning components is called LittleFilch.
Researchers found that LittleFilch can hook into the vdaemon process used by Cisco SD-WAN controllers. This allows the malware to inspect control-plane traffic after the relevant information has already been decrypted inside the legitimate process.
Talos assessed that the malware can identify specific edge routers and extract keying material associated with the encrypted traffic passing between network components.
The researchers assessed that a 32-byte field collected by LittleFilch represents AES-256 IPsec data-plane key material. The stolen information is then encrypted using RSA before being staged for transmission.
The ability to obtain encryption keys changes the nature of the threat.
Rather than simply gaining administrative access to a network management system, attackers could potentially obtain information that helps them access or analyse traffic protected by the affected encryption infrastructure.
That is particularly concerning for organisations handling sensitive information.
The other major KeyDrift component is PolyFlame, which functions as a backdoor and provides attackers with additional capabilities after the initial compromise.
Talos found that PolyFlame can execute commands, upload and download files and relay communications between an attacker-controlled command-and-control infrastructure and other systems.
The malware is also designed to blend into legitimate processes. Researchers observed it running inside the vdaemon process, making detection more difficult than it would be if the attackers simply installed an obvious malicious application.
The framework also uses modified service startup mechanisms to establish persistence.
On affected systems, attackers modified startup scripts and used an injector to place PolyFlame into legitimate processes. On a compromised Validator, researchers found a fake service designed to resemble a legitimate Cisco component.
These techniques demonstrate that the attackers were not simply looking for temporary access.
The design of KeyDrift indicates an effort to maintain a foothold and operate quietly inside the network management environment.
Talos described the activity as historical, meaning the researchers are reporting on previously observed intrusions rather than announcing that all of the activity is occurring in real time. The research does not establish exactly when every intrusion occurred.
That distinction is important for organisations assessing their own exposure.
A company that installed the Cisco security update after the vulnerability was disclosed may still need to investigate whether attackers had already gained access before the update was applied.
Patching closes the vulnerability, but it does not automatically prove that a previously compromised system is clean.
Cisco’s own remediation guidance specifically addresses this concern. The company recommends investigation of affected control components and provides procedures for determining whether indicators of compromise are present before or alongside remediation.
The wider security community has already treated exploitation of Cisco Catalyst SD-WAN as a serious issue.
A joint advisory from several national cybersecurity agencies warned organisations using Cisco Catalyst SD-WAN to investigate potential compromise, update affected systems and strengthen their deployments. The advisory specifically warned that SD-WAN management interfaces exposed directly to the internet face increased risk.
That warning is especially relevant because internet exposure can turn a vulnerability in a management platform into an externally reachable entry point.
Network management systems are valuable targets for advanced attackers because they can provide a central position from which to understand and potentially influence large parts of an organisation’s infrastructure.
The KeyDrift activity also raises questions about the broader threat landscape surrounding Cisco SD-WAN.
Talos assessed with high confidence that the infrastructure associated with UAT-11473 overlaps considerably with a covert network known as Silent Train, which has been associated with activity attributed to the Chinese state-linked threat actor commonly known as Volt Typhoon.
However, the infrastructure overlap should not be interpreted as proof that UAT-11473 and Volt Typhoon are the same threat actor.
Talos has not made that definitive attribution.
The distinction matters because cybersecurity attribution requires evidence beyond shared infrastructure. Attackers can reuse infrastructure, compromise third-party systems or operate through networks previously associated with other groups.
What is clear is that the activity fits a wider pattern in which advanced threat actors target network management and control systems rather than focusing solely on traditional endpoints.
That approach can be highly effective.
A compromised employee laptop may provide access to one user or one device. A compromised network management platform can potentially provide a much broader view of an organisation’s infrastructure.
For businesses, this changes how security teams need to think about patching.
The priority should not be limited to computers, smartphones and internet-facing applications. Network controllers, management appliances and orchestration platforms require the same level of attention because they can become high-value targets.
Cisco has released fixed software versions for affected Catalyst SD-WAN releases. The company says there is no workaround that replaces the security update, making upgrading the primary remediation measure.
For organisations that cannot immediately upgrade, Cisco has recommended restricting access to relevant management ports to known, trusted systems in appropriate on-premises deployments.
However, network restrictions are not a substitute for removing an existing compromise.
Organisations running affected Cisco SD-WAN infrastructure should therefore treat the issue as both a patching problem and a potential incident-response issue.
Security teams should establish which Catalyst SD-WAN components are deployed, determine whether they were vulnerable during the relevant period and review authentication and system logs for suspicious activity.
Cisco’s remediation material highlights unauthorised SSH activity as one area administrators should examine. In particular, unexpected successful logins associated with privileged SD-WAN accounts can warrant further investigation.
The presence of suspicious indicators should lead to a more comprehensive investigation rather than simply deleting files or restarting services.
This is because sophisticated malware can establish persistence in several locations, and removing one component may not eliminate an attacker’s access.
The discovery of KeyDrift also illustrates why encryption should not be treated as an absolute protection against a compromised control plane.
Encryption protects information while it is being transmitted, but the systems responsible for managing encryption keys can themselves become high-value targets.
If attackers obtain keying material from a trusted network controller, the security assumptions surrounding the encrypted traffic can be weakened.
For companies operating critical networks, that makes the protection of key-management processes just as important as protecting the encrypted data itself.
The incident also highlights the growing importance of supply-chain and infrastructure security.
Cisco Catalyst SD-WAN can form part of the underlying connectivity architecture used by large organisations. A vulnerability in such infrastructure can therefore have consequences that extend beyond the device itself.
Businesses should consider SD-WAN controllers as critical infrastructure and place them behind appropriate network controls, restrict administrative access and continuously monitor them for unexpected changes.
The UK National Cyber Security Centre and partner agencies have urged organisations using Cisco Catalyst SD-WAN to perform threat hunting, install the appropriate fixed releases, apply Cisco’s hardening guidance and continue monitoring for signs of compromise.
For organisations that have already patched CVE-2026-20127, the next question should be whether the vulnerability was exploited before the patch was installed.
That is the central lesson from the KeyDrift discovery.
A security update can prevent a known vulnerability from being exploited again, but it cannot by itself establish what happened while the system was exposed.
The emergence of a purpose-built malware framework also demonstrates the level of preparation involved in some advanced network intrusions. KeyDrift was not designed merely to obtain an initial foothold. Its components were built to remain inside legitimate SD-WAN processes, intercept sensitive information and provide attackers with continued access.
That makes the campaign particularly relevant to enterprises, government agencies and organisations operating sensitive infrastructure.
The immediate priority is straightforward: identify affected Cisco Catalyst SD-WAN deployments, apply the appropriate security updates and investigate systems that may have been exposed.
Organisations should also review their SD-WAN management interfaces to ensure they are not unnecessarily accessible from the public internet.
As attackers increasingly target the control systems that connect modern organisations, the security of network infrastructure is becoming as important as the security of individual devices.
The KeyDrift campaign is a reminder that a vulnerability in a network controller can become much more than a software problem. In the wrong hands, it can become a pathway to persistent access, sensitive network intelligence and cryptographic material that protects communications across an organisation.
For affected organisations, patching CVE-2026-20127 should therefore be treated as an urgent security priority, followed by a careful investigation for evidence of previous compromise.
The latest developments around Cisco SD-WAN also reinforce a broader principle for enterprise security: patching closes a door, but incident investigation determines whether someone already walked through it.
For more technology and cybersecurity coverage affecting businesses and organisations in Nigeria, readers can follow BusinessTech.ng.
